Overview

overview

10

Static

static

5

bbb786619b...cd.exe

windows7-x64

10

bbb786619b...cd.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    08-03-2024 16:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bbb786619b7371680726d89dc2b5bccd.exe

  • Size

    512KB

  • MD5

    bbb786619b7371680726d89dc2b5bccd

  • SHA1

    ee1d8db853cb3e977816a9f5d08b392faa06c232

  • SHA256

    ec424e4137803921bb6a96ecf2c5105f84571b8e72866d7f9692bdaec8979850

  • SHA512

    08349691205d42db82c5beae31ad654132087849ac63e56b8c702d052bc3dcd7cacdf189d7a6549add572928bc0039f64d5209a7fd87eed86eafe12299198b7d

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6j:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5W

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 5 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\bbb786619b7371680726d89dc2b5bccd.exe
    "C:\Users\Admin\AppData\Local\Temp\bbb786619b7371680726d89dc2b5bccd.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2916
    • C:\Windows\SysWOW64\urcydjsnqp.exe
      urcydjsnqp.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2460
      • C:\Windows\SysWOW64\awgdrhrh.exe
        C:\Windows\system32\awgdrhrh.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:2668
    • C:\Windows\SysWOW64\sanegisjzjlmrnw.exe
      sanegisjzjlmrnw.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2644
    • C:\Windows\SysWOW64\awgdrhrh.exe
      awgdrhrh.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2496
    • C:\Windows\SysWOW64\uxxojspmkadii.exe
      uxxojspmkadii.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2160
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2368
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2776
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2120

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\sanegisjzjlmrnw.exe
      Filesize

      512KB

      MD5

      ec3c241108f90938fddfb9979732d9fd

      SHA1

      e7ce18c7b04e2e12ebaa30c04813d011303cb79e

      SHA256

      49e981682191af85f72c8cd58cd0e388902f871464fd56f9d89033310db26d64

      SHA512

      299604f5e71fff262d841e1a546060d26ff7eff794174c9b30a633d02d3e274ec44217af605feca9fcfb7b78dfe1f6ed50122c7b2c98a4c0f5eb49dba8a0eeef

      Download Submit

    • C:\Windows\SysWOW64\uxxojspmkadii.exe
      Filesize

      512KB

      MD5

      7b82d9c4b27f796f8ead87b2fb3f0e96

      SHA1

      8541e8e9c31d97a8691f9e327ed350236453fa7a

      SHA256

      3b723392c83926ff5436faddf95b3e29f8e37c73ea29f2a2723371473b3e2735

      SHA512

      a060db1e1e466614d27cf2dda8259d85a49586709159b5cbc4074f9cc1a74737996dea120491cf8416b37d7f0f48981cddd9bc3f7d83190ce6664860de2599b8

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\awgdrhrh.exe
      Filesize

      512KB

      MD5

      b7f00705b2c565b55ad0f4105715fcd8

      SHA1

      a21ff1a4497c81cb30d5dce755db2f2afa52b294

      SHA256

      6f5cae4cef44383148c8acb3afb48bf0b35e5eab243063f8ab06642ff6ca1d69

      SHA512

      13e87f9b8a2e5c05a6b44e188786202db5671fa0c61693112239993cac626f6cbf44cc8d0e537cb11aac1ef044c550d702d908bc467f94400b38fb3d0707c7a6

      Download Submit

    • \Windows\SysWOW64\urcydjsnqp.exe
      Filesize

      512KB

      MD5

      2058da5778a3f4be448da269bd0b2d02

      SHA1

      423f33293af6047bf3f4458e320ea169eb30b996

      SHA256

      2628a0e4871dd5e586850c16f90765019f4a0f06fb1c13f40e168298db6aac5b

      SHA512

      b35abcb2179c8c8e3029950a5bf0b58fb7ba7e4dd5c6aaa0d792e84f4002e7722ef89ecd28d4466c6c40fd2b40285119991b42b93bfb1d672471fc42fef89538

      Download Submit

    • memory/2120-74-0x0000000004260000-0x0000000004261000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2120-77-0x0000000004260000-0x0000000004261000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2120-82-0x0000000003D40000-0x0000000003D50000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2368-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2368-47-0x000000007100D000-0x0000000071018000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2368-45-0x000000002F771000-0x000000002F772000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2368-75-0x000000007100D000-0x0000000071018000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2916-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download